Privacy notice
What we collect, why, who sees it, how long we keep it, and what you can ask us to do. It follows the Nigeria Data Protection Act 2023.
Who we are
Pacifylabs, Lagos, Nigeria runs SCIMS. For the records a dealer keeps about their own sellers and customers, the dealer decides why and how they are used and Pacifylabs processes them on the dealer's behalf. For the dealer's own account details, Pacifylabs decides. Questions: [email protected].
What we collect
- Your account: your name, email, phone number, password (stored only as a one-way hash), your role, and when you last signed in.
- Your business records: shops, devices and their identifiers, prices, purchases, sales, payments, credit balances, returns, receipts and the history of each device.
- Sellers and customers you record: name, phone, address, ID photo, and NIN and BVN where you enter them. NIN and BVN are encrypted, and only the last four digits are ever shown.
- Files you upload: seller IDs, proof of ownership, device photos and payment proof.
- Technical data: your IP address, browser type and the actions you take, kept in the audit log for security and so that records can be trusted.
- Notifications: if you allow them, an address your browser gives us so we can send you alerts.
- Online store orders: a customer's name, phone number, note and the devices they asked for, which go to the business they ordered from.
Why we use it, and our basis
- To provide the service you asked for (contract).
- To keep records that show where a device came from and to help a dealer deal with the police or a customer (the dealer's legitimate interest and legal obligations).
- To keep the service secure and to prevent fraud (legitimate interest).
- To send you email and notifications you need, or have switched on (contract and consent).
We do not sell personal data. We do not use it for advertising.
Who sees it
- Inside a dealer's business, people see only what their role allows. Sales staff do not see cost prices, profit or seller details.
- Pacifylabs staff can reach data only to run, secure and support the service, and their access is recorded.
- Service providers that help us run SCIMS: cloud hosting and database, file storage, email delivery and push notification delivery. They may only use data to provide their service to us.
- The police or a court, where the law requires it, or where a dealer exports an evidence pack and chooses to hand it over.
Where it is kept and how it is protected
Data is held on secure servers. Each business's data is separated from every other's at the database level. Connections are encrypted. Sensitive identity numbers are encrypted at rest. Records that serve as evidence cannot be edited or deleted by users.
How long we keep it
We keep a business's records while its account is open. After an account is closed we keep purchase, proof-of-ownership, sale and audit records for the period the law requires for business and police records, and then delete or anonymise them. Account details and files that are not needed as evidence are deleted sooner. Ask us for the current periods.
Your rights
You can ask to see the personal data we hold about you, to have it corrected, to have it deleted where we are not required to keep it, to object to a use, and to take a copy. If you are a seller or customer of a dealer, ask the dealer first. They decide what is done with your details, and we will help them answer you. You can also complain to the Nigeria Data Protection Commission.
Cookies and storage
We use a sign-in cookie that the site needs to work, and your browser's storage for settings such as light or dark mode. We do not use advertising or tracking cookies.
Changes
If we change this notice in a way that matters, we will tell you in the app. The version number at the top changes when it does.